Microsoft account unusual sign-in activity email, -----> Is this phishing?

Same here. I think this is spoofing... It would be a good measure of protection to log into our account and update your password and add multifactor authentication.

Microsoft account          

Unusual sign-in activity 

We detected something unusual about a recent sign-in to the Microsoft account XXXXXXXXX@XXX**** <mailto:*** Email address is removed for privacy ***?Subject=Report+The+User> .      

Sign-in details   

Country/region: Russia/Moscow              

IP address: 103.225.77.255         

Date: Thu, 31 Mar 2022 20:04:32 +0000

Platform: Windows 10   

Browser: Firefox              

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.           

Report The User <mailto:*** Email address is removed for privacy ***?subject=unusual sign-in activity&body=Report The User>               

To opt out or change where you receive security notifications, click here <mailto:*** Email address is removed for privacy ***?Subject=Unsubscribe+me> .              

Thanks,

The Microsoft account team       

 <http://neversuit.com/track/o12299GAloP89670kfza4870406ADA6051PuzD56>

Microsoft account          

Unusual sign-in activity 

We detected something unusual about a recent sign-in to the Microsoft account XXXXXXXXX@XXX**** <mailto:*** Email address is removed for privacy ***?Subject=Report+The+User> .      

Sign-in details   

Country/region: Russia/Moscow              

IP address: 103.225.77.255         

Date: Wed, 30 Mar 2022 19:11:16 +0000             

Platform: Windows 10   

Browser: Firefox              

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.           

Report The User <mailto:*** Email address is removed for privacy ***?subject=unusual sign-in activity&body=Report The User>               

To opt out or change where you receive security notifications, click here <mailto:*** Email address is removed for privacy ***?Subject=Unsubscribe+me> .              

Thanks,

The Microsoft account team       

 <http://neversuit.com/track/o12196hFahU89670eCcd4870406DSp6015EPcv56>

I usually just put things of this type into the phishing folder for all the good that actually does. But when I can to this site and saw that someone was told, or at least I thought that's what the reply said from a while back, I thought maybe I'm just too OCD about hacking and spam.
Thanks for your reply.

Same here. I think this is spoofing... It would be a good measure of protection to log into our account and update your password and add multifactor authentication.

Microsoft account          

Unusual sign-in activity 

We detected something unusual about a recent sign-in to the Microsoft account XXXXXXXXX@XXX**** <mailto:******@googlemail.com?Subject=Report+The+User> .      

Sign-in details   

Country/region: Russia/Moscow              

IP address: 103.225.77.255         

Date: Thu, 31 Mar 2022 20:04:32 +0000

Platform: Windows 10   

Browser: Firefox              

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.           

Report The User <mailto:******@googlemail.com?subject=unusual sign-in activity&body=Report The User>               

To opt out or change where you receive security notifications, click here <mailto:******@googlemail.com?Subject=Unsubscribe+me> .              

Thanks,

The Microsoft account team       

 <http://neversuit.com/track/o12299GAloP89670kfza4870406ADA6051PuzD56>

Microsoft account          

Unusual sign-in activity 

We detected something unusual about a recent sign-in to the Microsoft account XXXXXXXXX@XXX**** <mailto:******@googlemail.com?Subject=Report+The+User> .      

Sign-in details   

Country/region: Russia/Moscow              

IP address: 103.225.77.255         

Date: Wed, 30 Mar 2022 19:11:16 +0000             

Platform: Windows 10   

Browser: Firefox              

A user from Russia/Moscow just logged into your account from a new device, If this wasn't you, please report the user. If this was you, we'll trust similar activity in the future.           

Report The User <mailto:******@googlemail.com?subject=unusual sign-in activity&body=Report The User>               

To opt out or change where you receive security notifications, click here <mailto:******@googlemail.com?Subject=Unsubscribe+me> .              

Thanks,

The Microsoft account team       

 <http://neversuit.com/track/o12196hFahU89670eCcd4870406DSp6015EPcv56>

I read the above advise, and clicked the It was not me link. Well and good, but the a reply email that popped had a Google address for my response. *** Email address is removed for privacy ***

I'm concerned. Why would Microsoft use Gmail to receive it's response? Yes, I have a Chromebook and alternate using both Win10 and Chrome browsers on my Windows laptop, but it Still seems like Phishing to me. I'm not sending this until I get some clarification, and taking it out of my SPAM folder and putting into my Inbox so it won't disappear in another 7 days.
Thank you to anyone that can give me some peace of mind
Donna

Donna, those emails are indeed phishing. Microsoft would not use a Google address. The actual address was removed from your post, but I suspect it said "googlemail.com" and not even "gmail.com". Another sign it is bogus. You should re-mark that mail as spam / delete it.

It would not surprise me if the secondary aim of those mails were to get people to stop paying attention to any actual alerts that come through by just overloading us.

If you are ever concerned about activity, see https://account.live.com/Activity. You can learn more about the Recent Activity page at What is the Recent activity page? (microsoft.com)

Hi dBelcourt,

Thank you for posting your concern here at the Microsoft Community Forum.

We see that you received a notification that there was an unusual activity on your account. Yes, that email was from our system, and it is a legitimate Microsoft Account notification.

For your account's safety and security, every Microsoft Account has a feature that can detect if your account is being accessed outside of your usual sign in location. If you do not recognize the sign in attempt, we highly recommend that you change your password immediately. This will protect your account from being hacked.

In addition, we recommend that you consider adding an extra layer of security to your account. Here's how you can protect your Microsoft Account: How to help keep your Microsoft account safe and secure.

If you use a VPN connection, the system will detect that and it will continue to notify you of the unusual activity. If this is the case, you'll need to add your device as trusted to make sure that you won't be locked out, and keep all your security information (phone number and alternate email address) updated.

Let us know if you have additional queries.

I had the same email the other day saying someone in India signed into my account.

I read the above advise, and clicked the It was not me link. Well and good, but the a reply email that popped had a Google address for my response. ******@gmail.com

I'm concerned. Why would Microsoft use Gmail to receive it's response? Yes, I have a Chromebook and alternate using both Win10 and Chrome browsers on my Windows laptop, but it Still seems like Phishing to me. I'm not sending this until I get some clarification, and taking it out of my SPAM folder and putting into my Inbox so it won't disappear in another 7 days.
Thank you to anyone that can give me some peace of mind
Donna

I don't know what the legitimate email address is from Microsoft for these notifications. I can say that my father-in-law has been experiencing the same issue with a lot of these mails and they are going into his Junk folder. He has been checking for actual unusual activity as well and finding none. (Yay.) The most recent of these suspicious emails have no sender or reply address (which suggests it could be from the mail system) rather than some address that looks phishy. However, the big clue that remains is the URL of the "Report The User" button. In at least one of the emails the URL mailto address was "googlemail.com", which is obvious attempt to be close to "gmail.com".

It doesn't hurt to check accounts for suspicious activity during these times, but the mails with a questionable URL are phishing.

Good luck everyone!